Nutex Health confirms data theft in August cyberattack (The Gentlemen)

On 31 August 2026, Nutex Health Inc. — a Houston-based operator of hospitals and healthcare facilities across the United States — filed an Item 1.05 Form 8-K with the U.S. Securities and Exchange Commission confirming that a material cybersecurity incident had occurred and that information stored on its servers had been accessed and exfiltrated by an unauthorized third party. The company had first disclosed unauthorized network activity a week earlier, in an Item 8.01 filing on 24 August.

Nutex said the compromised data included patient and employee information, credentialed-provider records, and business and financial information that is private and/or confidential. The ransomware-as-a-service group known as The Gentlemen added Nutex Health to its leak site and claimed responsibility — the hallmark of a double-extortion attack, in which criminals both steal data and threaten to publish it.

What happened

Upon learning of the intrusion, Nutex activated its cybersecurity response plan, engaged an independent third-party response team and forensic experts, implemented containment measures, and notified law enforcement. A class-action complaint was filed against the company on 27 August in the U.S. District Court for the Southern District of Texas on behalf of individuals whose personal and protected health information may have been affected. As the data was published on the attackers' site, Nutex began the weeks-long process of downloading and analyzing it to determine its contents, scope and authenticity.

Why it matters

Healthcare operators remain among the most heavily targeted victims of ransomware, and the Nutex case shows the compounding consequences: a material SEC disclosure, exposure of sensitive patient and provider data, and near-immediate class-action litigation. It also reflects the double-extortion model's staying power, where publication of stolen data continues to pressure victims well after initial containment.